CVE-2020-36903
PUBLISHED 12/31/2025 83251b91-4cc7-4094-a5c7-464a1b83ea10
Technical Description
Selea CarPlateServer 4.0.1.6 contains an unquoted service path vulnerability in the Windows service configuration that allows local users to potentially execute code with elevated privileges. Attackers can exploit the service's unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during application startup or reboot.
Affected Products
Selea
Selea CarPlateServer (CPS)
4.0.1.6
References
https://www.exploit-db.com/exploits/49453
ExploitDB-49453
https://www.selea.com
Vendor Homepage
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5621.php
Zero Science Lab Disclosure (ZSL-2021-5621)
https://www.vulncheck.com/advisories/selea-carplateserver-local-privilege-escalation-via-unquoted-service-path
VulnCheck Advisory: Selea CarPlateServer 4.0.1.6 Local Privilege Escalation via Unquoted Service Path
Impact Analysis
Attack Vector Network
Attack Complexity Low
Privileges Required None